Page

INTRODUCTION

(A). BACKGROUND

Blockchain technology has revolutionized digital transactions, and Ethereum is now

the most popular platform for developing and executing smart contracts. In particular,

Decentralised Finance (DeFi) and Non-Fungible Tokens (NFTs) rely on smart contracts,

which are self-contained programs written in languages like Solidity and compiled into low-

level Ethereum Virtual Machine (EVM) [Link] deployment of smart contracts'

immutability assures tamper-proof execution, but it also indicates a big problem: any security

flaws or coding errors become irreversible, which can result in major financial loss. Several

notable DeFi breaches that followed, including the 2016 DAO attack, in which hackers stole

over 3.6 million ETH, demonstrate the urgent need for more robust security measures.

When faced with the increasing complexity and rapid evolution of smart contracts and

the EVM environment, traditional security auditing techniques usually fail. As a result, more

advanced techniques are needed to identify minor but harmful vulnerabilities that

conventional tools might miss. Even in cases where the source code is absent or has been

modified due to compiler optimisations, reverse engineering offers an efficient way for

analysts to dissect produced EVM bytecode, rebuild the underlying logic, and identify

vulnerabilities. Additionally, by analysing opcode-level data from smart contract bytecode,

machine learning techniques—such as Random Forest algorithms—have demonstrated

success in identifying patterns associated with fraudulent or insecure activity in DeFi

protocols.

(B). PROBLEM STATEMENT

While ongoing developments in smart contract development and security auditing

methodologies, discovering obscure, complex, and harmful flaws hidden within the EVM

bytecode remains an important challenge, particularly in DeFi and NFT projects. The

permanent nature of blockchain deployment exacerbates the scenario; once a defect is

discovered after launch, it is typically impossible to rectify without significant community

consensus, costly contract migrations, or other costly measures.

The majority of static analysis tools currently in use work relatively well on

straightforward problems, but they often become confused by context-specific flaws,

Resulting in either a large number of false alarms or, worse, a complete lack of detection of

sophisticated attack patterns that exploit minor logical faults. Many categories of critical

weaknesses remain poorly understood and frequently evade detection by existing techniques.

The DAO issue is a classic illustration of how inadequate sharing of lessons learned from

previous exploits has frequently resulted in significant losses throughout history.

An automated, quick, and highly accurate method that can consistently identify these

elusive flaws in compiled EVM bytecode is therefore desperately needed by the ecosystem.

By addressing risks prior to contracts becoming live, such a system would enable developers

and auditors to lower the likelihood of expensive exploits drastically.

(C). RESEARCH OBJECTIVES

This study seeks to tackle the highlighted challenges through the following goals:
 Page

1. To create a structured and repeatable process for reverse engineering Ethereum

EVM bytecode, enabling the extraction of key structural and behavioural patterns that reveal

potential vulnerabilities—even in cases where the source code is unavailable or has been

heavily altered by compiler optimisations.

2. To explore and implement machine learning methods, with the Random Forest

model, to automatically recognise hidden patterns and indicators of complex security

weaknesses directly within compiled EVM bytecode.

3. To test and measure the performance of the proposed approach in identifying both

known and previously unseen vulnerabilities in real-world Ethereum smart contracts,

especially those used in DeFi and NFT platforms, while overcoming the shortcomings of

current detection tools.

4. To strengthen the overall security of the Ethereum ecosystem by delivering a fast,

scalable, and practical framework that supports early and proactive discovery of risks in

smart contracts before they are deployed.

(D). RESEARCH METHODOLOGY

To provide reliable vulnerability discovery, the suggested approach combines

machine learning and reverse engineering.

Using advanced methods like Ghidra, the Ethereum EVM bytecode is reverse-

engineered to start the process. In this step, the compiled code is broken down into a readable

format, and key components, such as opcode sequences, control flow graphs—which are

especially challenging to accurately reconstruct due to the stack-based architecture of the

EVM—data dependencies, and general structural properties, are extracted. Following their

extraction, these components are arranged into a structured dataset that may be used for

machine learning analysis.

The last step involves training a Random Forest classifier on this dataset using

labelled samples that provide a clear distinction between secure bytecode patterns and those

that are vulnerable. In related tasks, such as opcode-based analysis for detecting fraudulent

behaviour in DeFi protocols, Random Forest has demonstrated impressive performance in the

past. The trained model gains the ability to identify complex and challenging indicators of

security flaws that are frequently missed by manual assessments or traditional static analysis

methods.

Lastly, a wide range of real-world smart contracts is utilised to assess the system's

effectiveness thoroughly. To find out the accuracy of the approach in identifying various

types of vulnerabilities commonly found in DeFi and NFT projects, key metrics, including

precision, recall, and F1-score, are calculated. This method guarantees that the approach is

dependable and feasible for actual implementation.

(E). SCOPE

This research focuses exclusively on Ethereum smart contracts which operate using

the Ethereum Virtual Machine (EVM).The subtle and often missed patterns that reveal

significant vulnerabilities in DeFi protocols and NFT initiatives will be the focus of the

vulnerability identification efforts. Reentrancy attacks, integer overflow and underflow

errors, ineffective access control systems, and other logic-related flaws are examples of these.

The Random Forest technique for machine learning-driven pattern detection and

Ghidra for reverse engineering generated bytecode will be the main tools utilised during the
 Page

project. The Ethereum network and its own EVM bytecode format will be the only ones used

for actual implementation, testing, and analyzation even if some of the fundamental ideas

may apply to other blockchain platforms.

(F). LIMITATIONS

This study acknowledges some potential limitations that could impact the whole

model.

The size, variation, and accuracy of the training data have a major impact on the

performance of the machine learning model. If the dataset has gaps, biases, or insufficient

examples of rare vulnerabilities, the model's accuracy may degrade. Random Forest can

occasionally behave like a "black box," making it difficult to pinpoint the precise reason why

particular bytecode portions are flagged as dangerous, despite its overall strength and

stability.

Because smart contract attacks are constantly changing, new exploit strategies are

frequently developed. To be successful against new threats, the model may therefore require

regular updates and retraining.

The method may struggle to identify runtime-dependent errors or vulnerabilities that

are only visible during specific transaction sequences, as it is primarily static and only

operates on compiled bytecode. For instance, it is particularly challenging to pinpoint

problems related to gas usage in the absence of real execution traces.

Lastly, only EVM bytecode patterns are included in the study. This approach may not

be able to discover defects that start in high-level languages like Solidity but disappear or

become unrecognisable after compilation.

(G). ORGANIZATION OF THE DISSERTATION

This dissertation is structured as follows:

Chapter 2: Related Work This chapter examines previous studies on smart contract

vulnerabilities, traditional static and dynamic analysis methods, and the growing use of

machine learning in blockchain and cybersecurity domains, with a focus on existing

vulnerability detection approaches.

Chapter 3: Background on Ethereum and Smart Contracts This chapter covers

essential concepts, including the Ethereum blockchain, the Ethereum Virtual Machine (EVM)

architecture, the Solidity programming language, and widely known attack patterns targeting

smart contracts.

Chapter 4: Methodology This chapter gives a detailed explanation of the proposed

framework, describing the reverse engineering workflow using Ghidra, the extraction of key

features such as opcode sequences and control flow graphs, the design and training of the

Random Forest classifier, and the complete experimental setup.

Chapter 5: Experimental Results and Analysis. This chapter presents the evaluation

outcomes, including performance metrics, comparisons with current detection tools, and real-

world case studies that highlight vulnerabilities identified by the system.

Chapter 6: Discussion This chapter interprets the results, explores their broader

impact, revisits the study's limitations, and suggests promising directions for future work.

Chapter 7: Conclusion This final chapter recaps the entire research, highlights the key

contributions, and provides closing remarks.